Every removal of keys, components or related material from secure storage and every load to an SCD is logged, the logs are stored securely such as with the components, kept for at least two years after the key is destroyed, and record date and time in and out, component identifier, purpose, the custodian's name and signature, a non-custodian witness's name and signature and the tamper-evident package number.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.